{"record":{"id":"627aacbe578ae302","repo":"googleapis/mcp-toolbox","slug":"elasticsearch-source-q-requires-either-username-p","errorCode":null,"errorMessage":"elasticsearch source %q requires either username/password or an API key","messagePattern":"elasticsearch source %q requires either username/password or an API key","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/elasticsearch/elasticsearch.go","lineNumber":113,"sourceCode":"\t}\n\n\t// Create a new Elasticsearch client with the provided configuration\n\tcfg := elasticsearch.Config{\n\t\tAddresses:       c.Addresses,\n\t\tInstrumentation: elasticsearch.NewOpenTelemetryInstrumentation(tracerProvider, false),\n\t\tHeader:          http.Header{\"User-Agent\": []string{ua + \" go-elasticsearch/\" + elasticsearch.Version}},\n\t}\n\n\t// Client need either username and password or an API key\n\tif c.Username != \"\" && c.Password != \"\" {\n\t\tcfg.Username = c.Username\n\t\tcfg.Password = c.Password\n\t} else if c.APIKey != \"\" {\n\t\t// API key will be set below\n\t\tcfg.APIKey = c.APIKey\n\t} else {\n\t\t// If neither username/password nor API key is provided, we throw an error\n\t\treturn nil, fmt.Errorf(\"elasticsearch source %q requires either username/password or an API key\", c.Name)\n\t}\n\n\tclient, err := elasticsearch.NewBaseClient(cfg)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// Test connection\n\tres, err := esapi.InfoRequest{\n\t\tInstrument: client.InstrumentationEnabled(),\n\t}.Do(ctx, client)\n\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdefer res.Body.Close()\n\n\tif res.IsError() {","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/elasticsearch/elasticsearch.go#L95-L131","documentation":"Thrown by Config.Initialize when an elasticsearch source defines neither a username+password pair nor an API key. The Elasticsearch client requires one of these credential mechanisms for authentication, so the toolbox refuses to initialize the source rather than creating a client that would fail on every request.","triggerScenarios":"Configuring an elasticsearch source in tools.yaml with only `addresses` set; or providing only `username` without `password` (both must be non-empty to take the basic-auth path); or the credential fields are present but resolved to empty strings via templating/env substitution.","commonSituations":"Pointing at a local dev cluster with xpack.security disabled and omitting credentials; typos in YAML keys (e.g. `apiKey` instead of `apikey`, or `pass` instead of `password`); users assuming anonymous access is allowed.","solutions":["Add both `username` and `password` to the elasticsearch source in tools.yaml","Or add an `apikey` field with a base64-encoded Elasticsearch API key","Verify YAML field names match exactly: `username`, `password`, `apikey` (lowercase)","Check that env-var templating for credentials resolves to non-empty values"],"exampleFix":"// before (tools.yaml)\nsources:\n  my-es:\n    kind: elasticsearch\n    addresses:\n      - http://localhost:9200\n// after\nsources:\n  my-es:\n    kind: elasticsearch\n    addresses:\n      - http://localhost:9200\n    username: elastic\n    password: ${ES_PASSWORD}","handlingStrategy":"validation","validationCode":"// Go: check before submitting tools.yaml or calling Initialize\nif (cfg.Username == \"\" || cfg.Password == \"\") && cfg.APIKey == \"\" {\n    return fmt.Errorf(\"elasticsearch source %q needs username/password or apikey\", cfg.Name)\n}","typeGuard":"func hasESCredentials(c elasticsearch.Config) bool {\n    return (c.Username != \"\" && c.Password != \"\") || c.APIKey != \"\"\n}","tryCatchPattern":null,"preventionTips":["Always template credentials from env vars in tools.yaml","Keep username and password together — one without the other is ignored","Remember the YAML key is lowercase `apikey`","Run `toolbox --tools-file tools.yaml` at startup in CI to catch config errors early"],"tags":["config","elasticsearch","authentication","missing-credentials"],"backgroundTag":"missing-credentials","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}